Home / CVEs
Exploited vulnerabilities (CISA KEV)
CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.
CVE-2016-5195
High · 7.0
KEV Urgent · 70 Public exploit CWE-362 Nov 10, 2016
Linux Kernel Race Condition Vulnerability
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
CVE-2014-3153
High · 7.8
KEV Urgent · 76 Public exploit Jun 7, 2014
Linux Kernel Privilege Escalation Vulnerability
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
CVE-2014-0196
Medium · 5.5
KEV High · 67 Public exploit CWE-362 May 7, 2014
Linux Kernel Race Condition Vulnerability
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
CVE-2013-6282
High · 8.8
KEV Urgent · 76 Public exploit CWE-20 Nov 20, 2013
Linux Kernel Improper Input Validation Vulnerability
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVE-2013-2094
High · 8.4
KEV Urgent · 70 Public exploit CWE-189 May 14, 2013
Linux Kernel Privilege Escalation Vulnerability
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
CVE-2013-2596
High · 7.8
KEV High · 60 Public exploit CWE-190 Apr 12, 2013
Linux Kernel Integer Overflow Vulnerability
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
CVE-2010-3904
High · 7.8
KEV Urgent · 76 Public exploit CWE-1284 Dec 6, 2010
Linux Kernel Improper Input Validation Vulnerability
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.